Analyzing call forwarding activity

ABSTRACT

A device may receive, from a network device, call information associated with a call. The call may be from a calling party device. The call may appear to be intended for a destination device. The call information may be received, from the network device, based on the network device having routed the call. The device may determine, based on the call information, that the call appears to have been forwarded to a called party device that is different from the destination device. The device may determine, based on the call information, a forwarding characteristic for the call. The device may determine that the forwarding characteristic satisfies a criterion. The device may send an output message based on the forwarding characteristic satisfying the criterion to support responding to call forwarding activity that has the forwarding characteristic.

RELATED APPLICATION

This application is a continuation of U.S. patent application Ser. No.15/174,870, filed Jun. 6, 2016, which is incorporated herein byreference.

BACKGROUND

Call forwarding (e.g., call diversion or the like) may enable users of anetwork (e.g., a telephone network) to redirect calls to anotherdestination (e.g., to a device associated with a different phonenumber). Call forwarding may allow a user to set a conditional and/orunconditional forwarding behavior to be applied to incoming calls (e.g.,to forward some or all incoming calls).

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1A and 1B are diagrams of an overview of an example implementationdescribed herein;

FIG. 2 is a diagram of an example environment in which systems and/ormethods, described herein, may be implemented;

FIG. 3 is a diagram of example components of one or more devices of FIG.2; and

FIG. 4 is a flow chart of an example process for analyzing callforwarding activity.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

The following detailed description of example implementations refers tothe accompanying drawings. The same reference numbers in differentdrawings may identify the same or similar elements.

In addition to legitimate uses of call forwarding (e.g., conditionaland/or unconditional forwarding to another location associated with auser), call forwarding may be used for various improper purposes. Forexample, call forwarding may be used to obfuscate call originationinformation, alter caller identification (ID) information to implement are-origination scheme (e.g., to improve an answer rate based on makingincoming calls appear to be local calls), bypass network controls on anoriginating network, engage in arbitrage based on service type (e.g.,local or long distance, wireless or wired, changing jurisdiction, or thelike), provide fraudulent charge numbers (e.g., for billing a forwardedportion of a call to an original destination device and/or to anunallocated number), or the like. Implementations described herein mayenable analyzing call forwarding activity. Analyzing call forwardingactivity may enable detection of call forwarding activity that isassociated with various improper purposes, which may allow a networkoperator to respond to improper call forwarding activity (e.g., byblocking call forwarding, terminating service, adjusting tariffs, or thelike). Implementations described herein may additionally enableanalyzing call forwarding activity that includes multiple chained,sequential, parallel, and/or forking (e.g., session initiation protocol(SIP) forking, including parallel forking and sequential forking) callforwarding activity.

FIGS. 1A and 1B are diagrams of an overview of an example implementation100 described herein. As shown in FIG. 1A, assume that a user has used acalling party device “A” to make a call (e.g., a voice call, a videocall, a data call, or another type of communication session) to anoriginal destination device “B.” Further assume that originaldestination device “B” has set up call forwarding to forward calls to acalled party device “C.” As will be more fully discussed below, the callwill be routed via an upstream network (e.g., by an upstream networkdevice), a network (e.g., by a network device), and a downstream network(e.g., by a downstream network device). For the purposes of thisoverview, assume that the various devices and/or networks are exchangingmessages that include call information associated with setting up,routing, and/or forwarding the call (e.g., SIP messages, SignalingSystem 7 (SS7) messages, or the like). Thus, references to sending callinformation and/or modified call information should be understood assending a message that includes the call information and/or the modifiedcall information. Further assume that the upstream network, the network,and the downstream network have sufficient information to route and/orforward the call as will be discussed below.

As further shown in FIG. 1A, and by reference number 102, the callingparty device “A” may initiate the call by sending call information tothe upstream network (e.g., to the upstream network device). The callinformation (e.g., {From: A; To: B}) may indicate that the call is to berouted from the calling party device “A” to the original destinationdevice “B.” As shown by reference number 104, and based on havingreceived the call information from the calling party device “A,” theupstream network device may continue routing the call, from the callingparty device “A” to the original destination device “B,” by sending thecall information to the network (e.g., to the network device, as shownby reference number 106).

As shown by reference number 108, the network device may modify the callinformation (e.g., based on the original destination device “B” havingset up call forwarding to the called party device “C”) to generatemodified call information (e.g., {From: A; To: B; Forward to: C}). Insome implementations, the modified call information may provide multiplechained, sequential, parallel, and/or forking call forwarding activity(e.g., {From: A; To: B; Forward to: C, where C can be one or more of C−1through C-N (N≥1)}). As further shown by reference number 108, thenetwork device may then route the call to the called party device “C” bysending the modified call information to the downstream network (e.g.,to the downstream network device, as shown by reference number 110). Asshown by reference number 112, and based on having received the modifiedcall information from the network device, the downstream network devicemay route the call to the called party device “C” by sending themodified call information to the called party device “C” (as shown byreference number 114).

As further shown in FIG. 1A, and by reference number 116, the networkdevice may send the call information and the modified call informationto the analysis device based on the network device having received thecall information from the upstream network device and having generatedthe modified call information. As shown by reference number 118, theanalysis device may analyze the call information and/or the modifiedcall information. Based on the analysis, the analysis device maydetermine that the call was forwarded (e.g., to the called party device“C”) and whether the forwarding exhibited a forwarding characteristic(e.g., service types involved, a forwarding rate, or the like) thatsatisfies a criterion (e.g., a combination of local and long distancecall legs, a forwarding rate that exceeds a threshold, a deviation froma forwarding baseline, or the like). As shown by reference number 120,the analysis device may send an output message to an output device basedon the results of the analysis.

As shown in FIG. 1B, assume that a user has used the calling partydevice “A” to make a call (e.g., a voice call, a video call, a datacall, or another type of communication session) to the called partydevice “C.” Further assume that, rather than routing a call directlyfrom the calling party device “A” to the called party device “C,” theupstream network device is to modify call information for the call suchthat the call appears to have been made to the original destinationdevice “B” and then forwarded to the called party device “C.” Forexample, the upstream network device may be taking advantage of a localcall from the calling party device “A” to the original destinationdevice “B” to avoid carrying a long distance call from the calling partydevice “A” to the called party device “C” (e.g., because the originaldestination device “B” will be charged for forwarding the call from theoriginal destination device “B” to the called party device “C”).

As shown in FIG. 1B, and by reference number 122, the calling partydevice “A” may initiate the call by sending call information to theupstream network (e.g., to the upstream network device). The callinformation (e.g., {From: A; To: C}) may indicate that the call is to berouted from the calling party device “A” to the called party device “C.”As shown by reference number 124, and based on having received the callinformation from the calling party device “A,” the upstream networkdevice may modify the call information to create modified callinformation (e.g., {From: A; To: B; Forward to: C}) that makes the callappear as if the call had been routed via the original destinationdevice “B.” In some implementations, the modified call information mayappear to provide multiple chained, sequential, parallel, and/or forkingcall forwarding activity (e.g., {From: A; To: B; Forward to: C, where Ccan be one or more of C−1 through C-N (N≥1)}). As further shown byreference number 124, the upstream network device may then route thecall by sending the modified call information to the network (e.g., tothe network device, as shown by reference number 126).

As shown by reference number 128, and based on having received themodified call information from the upstream network device, the networkdevice may then route the call to the called party device “C” by sendingthe modified call information to the downstream network (e.g., to thedownstream network device, as shown by reference number 130). As shownby reference number 132, and based on having received the modified callinformation from the network device, the downstream network device mayroute the call to the called party device “C” by sending the modifiedcall information to the called party device “C” (as shown by referencenumber 134).

As further shown in FIG. 1B, and by reference number 136, the networkdevice may send the modified call information to the analysis devicebased on the network device having received the modified callinformation from the upstream network device. As shown by referencenumber 138, the analysis device may analyze the modified callinformation to determine whether the call was forwarded. Based on theanalysis, the analysis device may determine that the call was forwardedand/or that the call appears to have been forwarded (e.g., by theoriginal destination device “B” and to the called party device “C”) andthat the forwarding exhibited a forwarding characteristic (e.g., localand long distance call legs, deviation from a forwarding baselineassociated with the calling party device “A,” the original destinationdevice “B,” the called party device “C,” the upstream network, thenetwork, and/or the downstream network, or the like) that satisfies acriterion (e.g., a combination of local and long distance call legs, aforwarding rate that deviates from a baseline forwarding rate, aninvolved service type that deviates from a baseline involved servicetype, a forwarding schedule that deviates from a baseline forwardingschedule, or the like). As shown by reference number 140, the analysisdevice may send an output message to the output device based on theresults of the analysis. In some implementations, the analysis deviceand/or the output device may send an instruction (e.g., to the networkdevice) to cause the network device to automatically take action (e.g.,terminate service, adjust tariffs, or the like) based on a determinationthat a forwarding characteristic satisfies a criterion.

In this way, implementations described herein may enable analyzing callforwarding activity. Analyzing call forwarding activity may enabledetection of improper call forwarding activity. Enabling detection ofimproper call forwarding activity may enable a network operator to blockand/or limit such activity. Blocking and/or limiting improper callforwarding activity may enable a network operator to reduce consumptionof network resources (e.g., by not carrying calls that a third party hasattempted to route and/or forward through the operator's network).Analyzing call forwarding activity may further enable traffic patternidentification (e.g., at ingress to a network, within the network,and/or at egress from the network), which may support traffic pooling orthe like.

As indicated above, FIGS. 1A and 1B are provided merely as an example.Other examples are possible and may differ from what was described withregard to FIGS. 1A and 1B.

FIG. 2 is a diagram of an example environment 200 in which systemsand/or methods, described herein, may be implemented. As shown in FIG.2, environment 200 may include a calling party device 205, an upstreamnetwork 210, one or more upstream network devices 215-1 through 215-J(J≥1) (hereinafter referred to collectively as “upstream network devices215,” and individually as “upstream network device 215”), a network 220,one or more network devices 225-1 through 225-K (K≥1) (hereinafterreferred to collectively as “network devices 225,” and individually as“network device 225”), an analysis device 230, an output device 235, anoriginal destination device 240, a downstream network 245, one or moredownstream network devices 250-1 through 250-M (M≥1) (hereinafterreferred to collectively as “downstream network devices 250,” andindividually as “downstream network device 250”), and/or a called partydevice 255. Devices of environment 200 may interconnect via wiredconnections, wireless connections, or a combination of wired andwireless connections.

Calling party device 205 includes a device that is capable ofcommunicating with one or more other devices included in environment200. For example, calling party device 205 may include a wiredcommunication device, a plain old telephone service (POTS) telephone, avoice over Internet protocol (VoIP) telephone, a wireless communicationdevice, a radiotelephone, a personal communications system (PCS)terminal (e.g., that may combine a cellular radiotelephone with dataprocessing and data communications capabilities), a smart phone, adesktop computer, a laptop computer, a tablet computer, a personalgaming system, and/or a similar device. In some implementations, callingparty device 205 may be capable of receiving and/or providinginformation associated with an Internet protocol (IP) MultimediaSubsystem (IMS) service. In some implementations, calling party device205 may include a device capable of initiating, receiving, and/orparticipating in a call (e.g., a voice call, a video call, a data call,or another type of communication session) with and/or from originaldestination device 240 and/or called party device 255. In someimplementations, calling party device 205 may be associated withupstream network 210 (e.g., upstream network 210 may be a home networkfor calling party device 205).

Upstream network 210 includes one or more wired and/or wirelessnetworks. For example, upstream network 210 may include a VoIP network,an IMS network, a session initiation protocol (SIP) network, a SignalingSystem 7 (SS7) network, a cellular network (e.g., a long-term evolution(LTE) network, a third generation (3G) network, a code division multipleaccess (CDMA) network, or the like), a public land mobile network(PLMN), a local area network (LAN), a wireless LAN (e.g., a Wi-Finetwork), a wide area network (WAN), a metropolitan area network (MAN),a telephone network (e.g., the Public Switched Telephone Network(PSTN)), a private network, an ad hoc network, an intranet, theInternet, a fiber optic-based network, a cloud computing network, or thelike, and/or a combination of these or other types of networks. In someimplementations, upstream network 210 may include one or more upstreamnetwork devices 215. In some implementations, upstream network 210 mayuse any protocol (e.g., SIP, SS7, SS7 utilizing an Advanced IntelligentNetwork (AIN), or the like) that allows upstream network device 215 toadd and/or modify call information (e.g., a call set up message oranother message associated with setting up and/or routing a call (e.g.,a voice call, a video call, a data call, or another type ofcommunication session)) to indicate that an originally dialed number hasbeen forwarded to another number.

Upstream network device 215 includes one or more devices capable oforiginating, sending, receiving, processing, controlling, and/ortransferring traffic and/or a message (e.g., a SIP message, an SS7message, or the like) associated with a call (e.g., a voice call, avideo call, a data call, or another type of communication sessionbetween calling party device 205, original destination device 240,and/or called party device 255). For example, upstream network device215 may include a server, a gateway, a router, a modem, a switch, afirewall, a network interface card (NIC), a hub, a bridge, a signalingend point, a reverse proxy, a server (e.g., a proxy server), a securitydevice, an intrusion detection device, a load balancer, an opticaladd/drop multiplexer (OADM), an end office switch, a softswitch, an IMScore device, a base station, or the like. In some implementations,upstream network device 215 may be an ingress device for upstreamnetwork 210 (e.g., at an originating edge of upstream network 210), anegress device for upstream network 210 (e.g., at a terminating edge ofupstream network 210), and/or an intermediate device within upstreamnetwork 210 (e.g., between the originating and terminating edges ofupstream network 210).

In some implementations (e.g., where upstream network 210 includes anIMS network), upstream network device 215 may include an applicationserver, a home subscriber server (HSS), an interrogating call sessioncontrol function device (I-CSCF), a serving call session controlfunction device (S-CSCF), and/or a proxy call session control functiondevice (P-CSCF). In some implementations (e.g., where upstream network210 includes a SIP network), upstream network device 215 may include aproxy server, a SIP registrar, a redirect server, a session bordercontroller, and/or a SIP gateway. In some implementations (e.g., whereupstream network 210 includes an SS7 network), upstream network device215 may include a service switching point (SSP), a signaling transferpoint (STP), and/or a service control point (SCP).

Network 220 includes one or more wired and/or wireless networks. Forexample, network 220 may include a VoIP network, an IMS network, a SIPnetwork, an SS7 network, a cellular network (e.g., an LTE network, a 3Gnetwork, a CDMA network, or the like), a PLMN, a LAN, a wireless LAN(e.g., a Wi-Fi network), a WAN, a MAN, a telephone network (e.g., thePSTN), a private network, an ad hoc network, an intranet, the Internet,a fiber optic-based network, a cloud computing network, or the like,and/or a combination of these or other types of networks. In someimplementations, network 220 may include one or more network devices225. In some implementations, network 220 may use any protocol (e.g.,SIP, SS7, SS7 utilizing an AIN, or the like) that allows network device225 to add and/or modify call information (e.g., a call set up messageor another message associated with setting up and/or routing a call(e.g., a voice call, a video call, a data call, or another type ofcommunication session)) to indicate that an originally dialed number hasbeen forwarded to another number. In some implementations, network 220and upstream network 210 may be operated by the same entity. In someimplementations, network 220 and upstream network 210 may be operated bydifferent entities. For example, upstream network 210 may be operated byan entity that purchases services (e.g., usage of network 220) from anentity that operates network 220.

Network device 225 includes one or more devices capable of originating,sending, receiving, processing, controlling, and/or transferring trafficand/or a message (e.g., a SIP message, an SS7 message, or the like)associated with a call (e.g., a voice call, a video call, a data call,or another type of communication session between calling party device205, original destination device 240, and/or called party device 255).For example, network device 225 may include a server, a gateway, arouter, a modem, a switch, a firewall, a NIC, a hub, a bridge, asignaling end point, a reverse proxy, a server (e.g., a proxy server), asecurity device, an intrusion detection device, a load balancer, anOADM, an end office switch, a softswitch, a base station, an IMS coredevice, or the like. In some implementations, network device 225 may bean ingress device for network 220 (e.g., at an originating edge ofnetwork 220), an egress device for network 220 (e.g., at a terminatingedge of network 220), and/or an intermediate device within network 220(e.g., between the originating and terminating edges of network 220).

In some implementations (e.g., where network 220 includes an IMSnetwork), network device 225 may include an application server, an HSS,an I-CSCF, an S-CSCF, and/or a P-CSCF. In some implementations (e.g.,where network 220 includes a SIP network), network device 225 mayinclude a proxy server, a SIP registrar, a redirect server, a sessionborder controller, and/or a SIP gateway. In some implementations (e.g.,where network 220 includes an SS7 network), network device 225 mayinclude an SSP, an STP, and/or an SCP.

Analysis device 230 includes one or more devices capable of analyzingtraffic and/or a message (e.g., a SIP message, an SS7 message, or thelike) associated with a call (e.g., a voice call, a video call, a datacall, or another type of communication session between calling partydevice 205, original destination device 240, and/or called party device255). For example, analysis device 230 may include a computing device(e.g., a desktop computer, a laptop computer, a tablet computer, ahandheld computer, a server computer, a smart phone, a gaming device, acomputer cluster, a cloud computer, or the like). In someimplementations, analysis device 230 may determine whether a call hasbeen forwarded and/or diverted and/or appears to have been forwardedand/or diverted. Although shown as being located external to network220, analysis device 230 may be implemented within one or more networkdevices 225. In some implementations, analysis device 230 may receivecall information from one or more network devices 225 (e.g., from anetwork device 225 acting as an ingress device, from a network device225 acting as an intermediate device, and/or from a network device 225acting as an egress device). In some implementations, analysis device230 may receive call information from a supplier (e.g., a third partyoperator of SS7 probes) of data for ingress to, and/or egress from,network 220.

Output device 235 includes any device capable of processing and/orpresenting (e.g., to a user) information output by analysis device 230to enable actions to be taken based on the information received fromanalysis device 230. For example, output device 235 may include a PCSterminal, a smart phone, a desktop computer, a laptop computer, a tabletcomputer, a personal gaming system, a printer, and/or a similar device.In some implementations, analysis device 230 and/or output device 235may automatically take action based on information output by analysisdevice 230.

Original destination device 240 includes a device that is capable ofcommunicating with one or more other devices included in environment200. For example, original destination device 240 may include a wiredcommunication device, a POTS telephone, a VoIP telephone, a wirelesscommunication device, a radiotelephone, a PCS terminal, a smart phone, adesktop computer, a laptop computer, a tablet computer, a personalgaming system, and/or a similar device. In some implementations,original destination device 240 may be capable of receiving and/orproviding information associated with an IMS service. In someimplementations, original destination device 240 may include a devicecapable of initiating, receiving, and/or participating in a call (e.g.,a voice call, a video call, a data call, or another type ofcommunication session) with and/or from calling party device 205 and/orcalled party device 255. In some implementations, original destinationdevice 240 may be associated with network 220 (e.g., network 220 may bea home network for original destination device 240).

Downstream network 245 includes one or more wired and/or wirelessnetworks. For example, downstream network 245 may include a VoIPnetwork, an IMS network, a SIP network, an SS7 network, a cellularnetwork (e.g., an LTE network, a 3G network, a CDMA network, or thelike), a PLMN, a LAN, a wireless LAN (e.g., a Wi-Fi network), a WAN, aMAN, a telephone network (e.g., the PSTN), a private network, an ad hocnetwork, an intranet, the Internet, a fiber optic-based network, a cloudcomputing network, or the like, and/or a combination of these or othertypes of networks. In some implementations, downstream network 245 mayinclude one or more downstream network devices 250. In someimplementations, downstream network 245 may use any protocol (e.g., SIP,SS7, SS7 utilizing an AIN, or the like) that allows downstream networkdevice 250 to add and/or modify call information (e.g., a call set upmessage or another message associated with setting up and/or routing acall (e.g., a voice call, a video call, a data call, or another type ofcommunication session)) to indicate that an originally dialed number hasbeen forwarded to another number. In some implementations, downstreamnetwork 245 and network 220 may be operated by the same entity. In someimplementations, downstream network 245 and network 220 may be operatedby different entities.

Downstream network device 250 includes one or more devices capable oforiginating, sending, receiving, processing, controlling, and/ortransferring traffic and/or a message (e.g., a SIP message, an SS7message, or the like) associated with a call (e.g., a voice call, avideo call, a data call, or another type of communication sessionbetween calling party device 205, original destination device 240,and/or called party device 255). For example, downstream network device250 may include a server, a gateway, a router, a modem, a switch, afirewall, a NIC, a hub, a bridge, a signaling end point, a reverseproxy, a server (e.g., a proxy server), a security device, an intrusiondetection device, a load balancer, an OADM, an end office switch, asoftswitch, a base station, an IMS core device, or the like. In someimplementations, downstream network device 250 may be an ingress devicefor downstream network 245 (e.g., at an originating edge of downstreamnetwork 245), an egress device for downstream network 245 (e.g., at aterminating edge of downstream network 245), and/or an intermediatedevice within downstream network 245 (e.g., between the originating andterminating edges of downstream network 245).

In some implementations (e.g., where downstream network 245 includes anIMS network), downstream network device 250 may include an applicationserver, an HSS, an I-CSCF, an S-CSCF, and/or a P-CSCF. In someimplementations (e.g., where downstream network 245 includes a SIPnetwork), downstream network device 250 may include a proxy server, aSIP registrar, a redirect server, a session border controller, and/or aSIP gateway. In some implementations (e.g., where downstream network 245includes an SS7 network), downstream network device 250 may include anSSP, an STP, and/or an SCP.

Called party device 255 includes a device that is capable ofcommunicating with one or more other devices included in environment200. For example, called party device 255 may include a wiredcommunication device, a POTS telephone, a VoIP telephone, a wirelesscommunication device, a radiotelephone, a PCS terminal, a smart phone, adesktop computer, a laptop computer, a tablet computer, a personalgaming system, and/or a similar device. In some implementations, calledparty device 255 may be capable of receiving and/or providinginformation associated with an IMS service. In some implementations,called party device 255 may include a device capable of initiating,receiving, and/or participating in a call (e.g., a voice call, a videocall, a data call, or another type of communication session) with and/orfrom calling party device 205 and/or original destination device 240. Insome implementations, called party device 255 may be associated withdownstream network 245 (e.g., downstream network 245 may be a homenetwork for called party device 255).

The number and arrangement of devices and networks shown in FIG. 2 areprovided as an example. In practice, there may be additional devicesand/or networks, fewer devices and/or networks, different devices and/ornetworks, or differently arranged devices and/or networks than thoseshown in FIG. 2. Furthermore, two or more devices shown in FIG. 2 may beimplemented within a single device, or a single device shown in FIG. 2may be implemented as multiple, distributed devices. Additionally, oralternatively, a set of devices (e.g., one or more devices) ofenvironment 200 may perform one or more functions described as beingperformed by another set of devices of environment 200.

FIG. 3 is a diagram of example components of a device 300. Device 300may correspond to calling party device 205, upstream network device 215,network device 225, analysis device 230, output device 235, originaldestination device 240, downstream network device 250, and/or calledparty device 255. In some implementations, calling party device 205,upstream network device 215, network device 225, analysis device 230,output device 235, original destination device 240, downstream networkdevice 250, and/or called party device 255 may include one or moredevices 300 and/or one or more components of device 300. As shown inFIG. 3, device 300 may include a bus 310, a processor 320, a memory 330,a storage component 340, an input component 350, an output component360, and a communication interface 370.

Bus 310 includes a component that permits communication among thecomponents of device 300. Processor 320 is implemented in hardware,firmware, or a combination of hardware and software. Processor 320includes a processor (e.g., a central processing unit (CPU), a graphicsprocessing unit (GPU), and/or an accelerated processing unit (APU)), amicroprocessor, and/or any processing component (e.g., afield-programmable gate array (FPGA) and/or an application-specificintegrated circuit (ASIC)) that interprets and/or executes instructions.In some implementations, processor 320 includes one or more processorscapable of being programmed to perform a function. Memory 330 includes arandom access memory (RAM), a read only memory (ROM), and/or anothertype of dynamic or static storage device (e.g., a flash memory, amagnetic memory, and/or an optical memory) that stores informationand/or instructions for use by processor 320.

Storage component 340 stores information and/or software related to theoperation and use of device 300. For example, storage component 340 mayinclude a hard disk (e.g., a magnetic disk, an optical disk, amagneto-optic disk, and/or a solid state disk), a compact disc (CD), adigital versatile disc (DVD), a floppy disk, a cartridge, a magnetictape, and/or another type of non-transitory computer-readable medium,along with a corresponding drive.

Input component 350 includes a component that permits device 300 toreceive information, such as via user input (e.g., a touch screendisplay, a keyboard, a keypad, a mouse, a button, a switch, and/or amicrophone). Additionally, or alternatively, input component 350 mayinclude a sensor for sensing information (e.g., a global positioningsystem (GPS) component, an accelerometer, a gyroscope, and/or anactuator). Output component 360 includes a component that providesoutput information from device 300 (e.g., a display, a speaker, and/orone or more light-emitting diodes (LEDs)).

Communication interface 370 includes a transceiver-like component (e.g.,a transceiver and/or a separate receiver and transmitter) that enablesdevice 300 to communicate with other devices, such as via a wiredconnection, a wireless connection, or a combination of wired andwireless connections. Communication interface 370 may permit device 300to receive information from another device and/or provide information toanother device. For example, communication interface 370 may include anEthernet interface, an optical interface, a coaxial interface, aninfrared interface, a radio frequency (RF) interface, a universal serialbus (USB) interface, a Wi-Fi interface, a cellular network interface, orthe like.

Device 300 may perform one or more processes described herein. Device300 may perform these processes in response to processor 320 executingsoftware instructions stored by a non-transitory computer-readablemedium, such as memory 330 and/or storage component 340. Acomputer-readable medium is defined herein as a non-transitory memorydevice. A memory device includes memory space within a single physicalstorage device or memory space spread across multiple physical storagedevices.

Software instructions may be read into memory 330 and/or storagecomponent 340 from another computer-readable medium or from anotherdevice via communication interface 370. When executed, softwareinstructions stored in memory 330 and/or storage component 340 may causeprocessor 320 to perform one or more processes described herein.Additionally, or alternatively, hardwired circuitry may be used in placeof or in combination with software instructions to perform one or moreprocesses described herein. Thus, implementations described herein arenot limited to any specific combination of hardware circuitry andsoftware.

The number and arrangement of components shown in FIG. 3 are provided asan example. In practice, device 300 may include additional components,fewer components, different components, or differently arrangedcomponents than those shown in FIG. 3. Additionally, or alternatively, aset of components (e.g., one or more components) of device 300 mayperform one or more functions described as being performed by anotherset of components of device 300.

FIG. 4 is a flow chart of an example process 400 for analyzing callforwarding activity. In some implementations, one or more process blocksof FIG. 4 may be performed by analysis device 230. In someimplementations, one or more process blocks of FIG. 4 may be performedby another device or a group of devices separate from or includinganalysis device 230, such as calling party device 205, upstream networkdevice 215, network device 225, output device 235, original destinationdevice 240, downstream network device 250, and/or called party device255.

As shown in FIG. 4, process 400 may include receiving, from a networkdevice, call information associated with a call that appears to berouted, from a calling party device, to an original destination device(block 410). For example, analysis device 230 may receive, from networkdevice 225, call information associated with a call (e.g., a voice call,a video call, a data call, or another type of communication session)that is being routed and/or appears to be routed, from calling partydevice 205, to original destination device 240. In some implementations,a call that appears to be routed, from calling party device 205, tooriginal destination device 240, may include a call that is beingrouted, from calling party device 205, to original destination device240.

Call information may include information regarding routing and/orapparent routing of a call, along with various details associated withthe call. For example, call information may include call originationinformation, call routing information, call forwarding information, calldestination information, device information, network information,billing information, or the like. In some implementations, callinformation may include real time (e.g., during a call) and/or post-calldata. In some implementations, call information may include a calldetail record (CDR).

In some implementations, call information may include identificationinformation associated with a device and/or a network involved with acall. For example, call information may include a device identifierassociated with calling party device 205, original destination device240, and/or called party device 255. In some implementations, a deviceidentifier may be a telephone number, an address (e.g., a networkaddress, such as an IP address, a Uniform Resource Identifier (URI), aUniform Resource Locator (URL), or the like), a mobile device number(MDN), an international mobile subscriber identity (IMSI), a temporarymobile subscriber identity (TMSI), or the like. Call information mayadditionally, or alternatively, include an address for a device (e.g.,upstream network device 215, network device 225, and/or downstreamnetwork device 250) associated with upstream network 210, network 220,and/or downstream network 245. In some implementations, an address mayinclude a network address (e.g., an IP address), a URI, a URL, or thelike.

In some implementations, analysis device 230 may obtain call informationfrom a message associated with the call (e.g., a SIP message, an SS7message, or the like) that analysis device 230 receives from networkdevice 225. For example, network device 225 may send, to analysis device230, a call routing message and/or a call set up message (e.g., amessage that network device 225 received from upstream network 210).

In some implementations (e.g., when network 220 is using SIP (e.g., whennetwork 220 includes an IMS network)), the call routing message and/orthe call set up message may include a SIP request message and/or a SIPresponse message. For example, the call routing message and/or the callset up message may include a SIP INVITE message (e.g., a SIP request toestablish a media session between SIP user agents (e.g., logical networkend-points used in a SIP session)). The SIP INVITE message may include a“To” field (e.g., with a device identifier associated with the intendedrecipient), a “From” field (e.g., with a device identifier associatedwith the sender), one or more “Via” fields (e.g., with a deviceidentifier associated with a device where a response is expected and/ora device identifier associated with a server that may have routed themessage), or the like. In some implementations, the SIP INVITE messagemay include a “Diversion” header, which carries information associatedwith forwarding a call. For example, a call may be forwarded (e.g., whenusing SIP) by adding a “Diversion” header to a SIP INVITE message and/orrewriting an existing “Diversion” header. The added or rewritten“Diversion” header may include a device identifier associated withcalling party device 205, original destination device 240, and/or calledparty device 255. In some implementations, the SIP INVITE message mayinclude information associated with forwarding a call other than in a“Diversion” header.

In some implementations (e.g., when network 220 is an SS7 network), thecall routing message and/or the call set up message may include an SS7initial address message (SS7 IAM). The SS7 IAM may be used to initiatesignaling to establish a call within an SS7 network (e.g., signalingbetween two service switching points (SSPs)). In some implementations,the SS7 IAM may include various parameters (e.g., “Calling PartyNumber,” “Original Called Number,” “Redirection Information,”“Redirecting Number,” “Charge Number,” or the like), which may include adevice identifier associated with calling party device 205, originaldestination device 240, and/or called party device 255.

In some implementations, analysis device 230 may receive callinformation based on network device 225 routing, forwarding, and/orappearing to have forwarded a call. For example, network device 225 maysend call information to analysis device 230 based on network device 225routing a call (e.g., a call from calling party device 205 and/or a callto original destination device 240), forwarding a call (e.g., to calledparty device 255), and/or appearing to have forwarded a call (e.g., tocalled party device 255). In some implementations, network device 225may route, forward, and/or appear to have forwarded a call based on thecall information. In some implementations, network device 225 may route,forward, and/or appear to have forwarded a call that was routed tonetwork device 225 from upstream network 210 (e.g., by upstream networkdevice 215).

In some implementations, analysis device 230 may receive callinformation from an ingress device for network 220. For example,analysis device 230 may receive call information from an ingress devicefor network 220 when analysis device 230 receives call information froma network device 225 that is at an originating edge of network 220. Insome implementations (e.g., where network 220 includes an IMS network),network device 225 may be an ingress device for network 220 when networkdevice 225 is an I-CSCF that receives call information from anothernetwork (e.g., from upstream network 210). In some implementations(e.g., where network 220 is an SS7 network), network device 225 may bean ingress device for network 220 when network device 225 is a gatewaySTP.

In some implementations, analysis device 230 may receive callinformation from an egress device for network 220. For example, analysisdevice 230 may receive call information from an egress device fornetwork 220 when analysis device 230 receives call information from anetwork device 225 that is at a terminating edge of network 220. In someimplementations (e.g., where network 220 includes an IMS network),network device 225 may be an egress device for network 220 when networkdevice 225 is an S-CSCF that sends call information to another network(e.g., to downstream network 245). In some implementations (e.g., wherenetwork 220 is an SS7 network), network device 225 may be an egressdevice for network 220 when network device 225 is a gateway STP.

In some implementations, analysis device 230 may receive callinformation from an intermediate device within network 220. For example,analysis device 230 may receive call information from an intermediatedevice within network 220 when analysis device 230 receives callinformation from a network device 225 that is between the originatingand terminating edges of network 220. In some implementations, networkdevice 225 may be an intermediate device within network 220 when networkdevice 225 receives call information from an ingress device for network220. Additionally, or alternatively, network device 225 may be anintermediate device within network 220 when network device 225 sendscall information to an egress device for network 220.

In some implementations (e.g., where network 220 includes an IMSnetwork), network device 225 may be an intermediate device withinnetwork 220 when network device 225 is an S-CSCF that receives callinformation from an I-CSCF in network 220, sends call information to anapplication server (AS) within network 220, and/or receives callinformation from an AS within network 220. Additionally, oralternatively, network device 225 may be an intermediate device withinnetwork 220 when network device 225 is an AS that receives callinformation from an S-CSCF within network 220 and/or sends callinformation to an S-CSCF within network 220. In some implementations(e.g., where network 220 is an SS7 network), network device 225 may bean intermediate device within network 220 when network device 225 is anSSP, STP, and/or SCP.

In some implementations, receiving call information from a networkdevice may include receiving call information from a data source (e.g.,an SS7 probe or the like) that obtained the call information beforeand/or after a call reached an originating edge of network 220 (e.g.,before and/or after ingress to network 220). In some implementations,receiving call information from a network device may include receivingcall information from a data source (e.g., an SS7 probe or the like)that obtained the call information before and/or after a call reached aterminating edge of network 220 (e.g., before and/or after egress fromnetwork 220). In some implementations, the data source (e.g., an SS7probe or the like) may be operated by an operator of network 220. Insome implementations, the data source (e.g., an SS7 probe or the like)may be operated by an entity other than the operator of network 220(e.g., a third party vendor).

As further shown in FIG. 4, process 400 may include determining, basedon the call information, that the call appears to have been forwarded toa called party device (block 420). For example, having received the callinformation from network device 225, analysis device 230 may determinewhether the call appears to have been forwarded (e.g., from originaldestination device 240 and/or to called party device 255). In someimplementations, determining that a call appears to have been forwarded(e.g., from original destination device 240 and/or to called partydevice 255) may include determining that the call is being forwarded(e.g., from original destination device 240 and/or to called partydevice 255). In some implementations, analysis device 230 may determinewhether network device 225 forwarded the call and/or appears to haveforwarded the call (e.g., from original destination device 240 and/or tocalled party device 255).

Analysis device 230 may determine that the call appears to have beenforwarded based on the call information. For example, analysis device230 may obtain, from the call information, a device identifierassociated with calling party device 205, original destination device240, and/or called party device 255. In some implementations, analysisdevice 230 may determine that the call appears to have been forwardedbased on the call information including a device identifier for calledparty device 255 (e.g., the device to which the call appears to havebeen forwarded) in addition to a device identifier for originaldestination device 240 (e.g., the device that appears to have originallybeen called by calling party device 205). In some implementations,analysis device 230 may determine that the call appears to have beenforwarded based on a message (e.g., a SIP message, an SS7 message, orthe like) included in the call information that analysis device 230receives from network device 225.

In some implementations (e.g., when network 220 is using SIP (e.g., whennetwork 220 includes an IMS network)), analysis device 230 may determinethat a call appears to have been forwarded based on a SIP messageassociated with the call. For example, analysis device 230 may determinethat a call appears to have been forwarded when a SIP message (e.g., aSIP INVITE message) includes a diversion header. In someimplementations, analysis device 230 may determine that a call appearsto have been forwarded when a SIP message includes call forwardinginformation other than in a diversion header.

In some implementations (e.g., when network 220 is an SS7 network),analysis device 230 may determine that the call appears to have beenforwarded based on an SS7 message associated with the call. For example,analysis device 230 may determine that a call appears to have beenforwarded when an SS7 message includes the “Original Called Number”parameter. In some implementations, analysis device 230 may determinethat a call appears to have been forwarded when an SS7 message includescall forwarding information other than in the “Original Called Number”parameter.

As further shown in FIG. 4, process 400 may include determining, basedon the call information, a forwarding characteristic for the call (block430). For example, having determined that a call appears to have beenforwarded, analysis device 230 may determine a forwarding characteristicfor the call based on the call information. The forwardingcharacteristic may indicate involved service types, a forwarding rate, aforwarding baseline, deviation from a forwarding baseline, multipleforwards associated with a single call, or the like.

In some implementations, analysis device 230 may determine a forwardingcharacteristic associated with a specific device and/or network. Forexample, analysis device 230 may determine a forwarding characteristicbased on a device identifier associated with calling party device 205,original destination device 240, and/or called party device 255. In someimplementations, determining a forwarding characteristic for the callmay include determining (e.g., based on a lookup in an HSS, an SS7service data point (SDP) database, and/or another suitable database)that a device identifier associated with original destination device 240is an unallocated number (e.g., that the device identifier isfictitious). Additionally, or alternatively, analysis device 230 maydetermine a forwarding characteristic based on a network identifierassociated with upstream network 210, network 220, and/or downstreamnetwork 245.

In some implementations, analysis device 230 may determine, based on thecall information, involved service types (e.g., local, long distance,wireless, wired, cross-jurisdiction, or the like) for various legs ofthe call. For example, analysis device 230 may determine that a callfrom calling party device 205 to original destination device 240 is alocal call. Additionally, or alternatively, analysis device 230 maydetermine that a call from original destination device 240 to calledparty device 255 is a long distance call. Additionally, oralternatively, analysis device 230 may determine that a call fromcalling party device 205 to called party device 255 is a long distancecall. Additionally, or alternatively, analysis device 230 may determinethat a call from calling party device 205 to original destination device240 is associated with a first jurisdiction, while a call from originaldestination device 240 to the called party device 255 is associated witha second jurisdiction.

In some implementations, analysis device 230 may determine, based on thecall information, a forwarding rate associated with calling party device205, original destination device 240, called party device 255, upstreamnetwork 210, network 220, and/or downstream network 245. In someimplementations, a forwarding rate may be a ratio of forwarded calls tototal calls associated with a particular device (e.g., calling partydevice 205, original destination device 240, and/or called party device255) and/or with a particular network (e.g., upstream network 210,network 220, and/or downstream network 245).

In some implementations, analysis device 230 may determine, based on thecall information, a forwarding baseline associated with calling partydevice 205, original destination device 240, called party device 255,upstream network 210, network 220, and/or downstream network 245. Insome implementations, a forwarding baseline may include a baselineforwarding rate, a baseline of involved service types, a baselineforwarding schedule, or the like.

In some implementations, a forwarding baseline may be based onhistorical call forwarding activity associated with a particular device(e.g., calling party device 205, original destination device 240, and/orcalled party device 255) and/or with a particular network (e.g.,upstream network 210, network 220, and/or downstream network 245). Forexample, analysis device 230 may compile a forwarding baseline based oncall information received, over time, from network device 225.

In some implementations, a forwarding baseline may be based on callforwarding activity that has been agreed upon by one or more usersassociated with a particular device (e.g., calling party device 205,original destination device 240, and/or called party device 255) and/orone or more operators associated with a particular network (e.g.,upstream network 210, network 220, and/or downstream network 245). Forexample, a user may agree with a network operator that specified callforwarding activity is permissible. In some implementations, suchpermissible call forwarding activity may be based on appropriate tariffsfor the call forwarding activity.

As further shown in FIG. 4, process 400 may include determining that theforwarding characteristic satisfies a criterion (block 440). Forexample, having determined a forwarding characteristic for a call,analysis device 230 may determine whether the forwarding characteristicsatisfies a criterion. In some implementations, analysis device 230 maydetermine whether a forwarding characteristic satisfies a criterionbased on comparing the forwarding characteristic and the criterion.

In some implementations, analysis device 230 may determine that aforwarding characteristic satisfies a criterion associated with aparticular device (e.g., calling party device 205, original destinationdevice 240, and/or called party device 255) and/or with a particularnetwork (e.g., upstream network 210, network 220, and/or downstreamnetwork 245). In some implementations, analysis device 230 may determinethat a forwarding characteristic does not satisfy a criterion associatedwith a particular device (e.g., calling party device 205, originaldestination device 240, and/or called party device 255) and/or with aparticular network (e.g., upstream network 210, network 220, and/ordownstream network 245).

In some implementations, analysis device 230 may determine that aforwarding characteristic satisfies a criterion based on deviation froma forwarding baseline. For example, analysis device 230 may determinethat a forwarding characteristic satisfies a criterion when a forwardingrate deviates from a baseline forwarding rate, an involved service typedeviates from a baseline involved service type, a forwarding scheduledeviates from a baseline forwarding schedule, or the like.

In some implementations, analysis device 230 may determine that aforwarding characteristic satisfies a criterion based on evaluatinginvolved service types for a call. For example, analysis device 230 maydetermine that a forwarding characteristic satisfies a criterion when acall from calling party device 205 to original destination device 240 isa local call and either a call from original destination device 240 tocalled party device 255 or a call from calling party device 205 tocalled party device 255 is a long distance call. Additionally, oralternatively, analysis device 230 may determine that a forwardingcharacteristic satisfies a criterion when a call from calling partydevice 205 to original destination device 240 is associated with a firstjurisdiction, while a call from original destination device 240 tocalled party device 255 is associated with a second jurisdiction that isdifferent from the first jurisdiction. Evaluating involved service typesmay enable detection of call forwarding activity that selectivelyforwards calls through different networks to split a call into multiplesegments, some of which may be local calls and some of which may be longdistance calls, for purposes of arbitrage.

In some implementations, analysis device 230 may determine that aforwarding characteristic satisfies a criterion based on determining(e.g., based on a lookup in an HSS, an SS7 service data point (SDP)database, and/or another suitable database) that a device identifierassociated with original destination device 240 is an unallocatednumber. For example, calling party device 205 and/or upstream network210 may inject a fictitious device identifier for original destinationdevice 240 (e.g., add a fictitious diversion header to a SIP INVITEmessage). Based on the fictitious device identifier, a call to calledparty device 255 may appear to be going to original destination device240 (e.g., a local call from calling party device 205). However, thecall may then be forwarded to called party device 255, rather thanhaving gone directly to called party device 255, which may be a longdistance call for calling party device 205 and/or original destinationdevice 240.

In some implementations, analysis device 230 may determine that aforwarding characteristic satisfies a criterion based on a threshold.For example, analysis device 230 may determine that a forwarding rateand/or a forwarding schedule exceeds a threshold. In someimplementations, analysis device 230 may consider multiple differentthresholds. For example, analysis device 230 may use differentthresholds for different forwarding characteristics. In someimplementations, a forwarding rate over 25%, 50%, or 75% may exceed athreshold. In some implementations, any call forwarding activity thatinvolves different service types (e.g., local and long distance,multiple jurisdictions, or the like) and deviates from a forwarding baseline may exceed the threshold. In some implementations, any use of adevice identifier associated with original destination device 240 thatis an unallocated number may exceed the threshold.

As further shown in FIG. 4, process 400 may include sending an outputmessage based on the forwarding characteristic satisfying the criterion(block 450). For example, analysis device 230 may send an output message(e.g., to output device 235) based on determining that the forwardingcharacteristic satisfies the criterion.

In some implementations, the output message may provide information tosupport responding to call forwarding activity that has a particularforwarding characteristic and/or that has a forwarding characteristicthat satisfies a criterion (e.g., deviation from a forwarding baseline,a forwarding type, a threshold, or the like). For example, the outputmessage may identify forwarding activity associated with improper usageof call forwarding (e.g., call origination obfuscation, caller IDalteration, service type arbitrage, providing fraudulent or unallocatedcharge numbers, or the like). In some implementations, the outputmessage may include information to support baseline trending, resourceallocation, or the like.

In some implementations, analysis device 230 and/or output device 235may send, to third parties, information based on the output message toenable the third parties to act on the information. For example,analysis device 230 and/or output device 235 may send the information toa user of calling party device 205, an operator of upstream network 210,an operator of network 220, a user of original destination device 240,an operator of downstream network 245, and/or a user of called partydevice 255.

In some implementations, analysis device 230 and/or output device 235may cause network device 225 to automatically take action based oninformation output by analysis device 230. For example, based on adetermination that a forwarding characteristic satisfies a criterion,analysis device 230 and/or output device 235 may send an instruction(e.g., to network device 225) to configure network device 225 toautomatically block an attempt to forward a call, terminate service(e.g., for original destination device 240), terminate a relationshipwith an operator of upstream network 210 and/or an operator ofdownstream network 245, adjust and/or throttle service, adjust ratesand/or tariffs, or the like.

Although FIG. 4 shows example blocks of process 400, in someimplementations, process 400 may include additional blocks, fewerblocks, different blocks, or differently arranged blocks than thosedepicted in FIG. 4. Additionally, or alternatively, two or more of theblocks of process 400 may be performed in parallel.

In this way, implementations described herein may enable analyzing callforwarding activity. Analyzing call forwarding activity may enabledetection of improper call forwarding activity. Enabling detection ofimproper call forwarding activity may enable a network operator to blockand/or limit such activity. Blocking and/or limiting improper callforwarding activity may enable a network operator to conserve networkresources (e.g., by not carrying calls that a third party has attemptedto route and/or forward through the operator's network). Analyzing callforwarding activity may further enable traffic pattern identification(e.g., at ingress, egress, and/or within a network), which may supporttraffic pooling or the like.

The foregoing disclosure provides illustration and description, but isnot intended to be exhaustive or to limit the implementations to theprecise form disclosed. Modifications and variations are possible inlight of the above disclosure or may be acquired from practice of theimplementations.

As used herein, the term component is intended to be broadly construedas hardware, firmware, or a combination of hardware and software.

Some implementations are described herein in connection with thresholds.As used herein, satisfying a threshold may refer to a value beinggreater than the threshold, more than the threshold, higher than thethreshold, greater than or equal to the threshold, less than thethreshold, fewer than the threshold, lower than the threshold, less thanor equal to the threshold, equal to the threshold, etc.

To the extent the aforementioned embodiments collect, store, or employpersonal information provided by individuals, it should be understoodthat such information shall be used in accordance with all applicablelaws concerning protection of personal information. Additionally, thecollection, storage, and use of such information may be subject toconsent of the individual to such activity, for example, through wellknown “opt-in” or “opt-out” processes as may be appropriate for thesituation and type of information. Storage and use of personalinformation may be in an appropriately secure manner reflective of thetype of information, for example, through various encryption andanonymization techniques for particularly sensitive information.

It will be apparent that systems and/or methods, described herein, maybe implemented in different forms of hardware, firmware, or acombination of hardware and software. The actual specialized controlhardware or software code used to implement these systems and/or methodsis not limiting of the implementations. Thus, the operation and behaviorof the systems and/or methods were described herein without reference tospecific software code—it being understood that software and hardwarecan be designed to implement the systems and/or methods based on thedescription herein.

Even though particular combinations of features are recited in theclaims and/or disclosed in the specification, these combinations are notintended to limit the disclosure of possible implementations. In fact,many of these features may be combined in ways not specifically recitedin the claims and/or disclosed in the specification. Although eachdependent claim listed below may directly depend on only one claim, thedisclosure of possible implementations includes each dependent claim incombination with every other claim in the claim set.

No element, act, or instruction used herein should be construed ascritical or essential unless explicitly described as such. Also, as usedherein, the articles “a” and “an” are intended to include one or moreitems, and may be used interchangeably with “one or more.” Furthermore,as used herein, the term “set” is intended to include one or more items(e.g., related items, unrelated items, a combination of related andunrelated items, etc.), and may be used interchangeably with “one ormore.” Where only one item is intended, the term “one” or similarlanguage is used. Also, as used herein, the terms “has,” “have,”“having,” or the like are intended to be open-ended terms. Further, thephrase “based on” is intended to mean “based, at least in part, on”unless explicitly stated otherwise.

What is claimed is:
 1. A device, comprising: a memory; and one or moreprocessors to: receive, from a network device, call informationassociated with a call; determine, based on the call information, thatthe call appears to have been forwarded to a called party device;determine, based on the call information, a forwarding characteristicfor the call; determine that the forwarding characteristic satisfies acriterion based on at least one of: a forwarding rate deviating from abaseline forwarding rate, the forwarding rate satisfying a firstthreshold, a forwarding schedule deviating from a baseline forwardingschedule, or the forwarding schedule satisfying a second threshold; sendan output message, based on the forwarding characteristic satisfying thecriterion, to support responding to call forwarding activity having theforwarding characteristic; and cause the network device to automaticallytake action based on the output message.
 2. The device of claim 1, wherethe output message identifies forwarding activity associated withimproper usage of call forwarding.
 3. The device of claim 1, where theone or more processors are further to: send, based on the forwardingcharacteristic satisfying the criterion, an instruction to at least oneof: automatically block an attempt to forward a call, terminate service,terminate a relationship with an operator of an upstream network,terminate a relationship with an operator of a downstream network,adjust a service, throttle a service, adjust rates, or adjust tariffs.4. The device of claim 1, where the one or more processors, whenreceiving the call information, are to: receive the call informationbased on the network device routing the call.
 5. The device of claim 1,where the one or more processors, when determining that the call appearsto have been forwarded to the called party device, are to: determinethat the call appears to have been forwarded to the called party devicebased on the call information comprising: a first device identifierassociated with the called party device, and a second device identifierassociated with an original destination device.
 6. The device of claim1, where the one or more processors, when determining the forwardingcharacteristic, are to: determining that a device identifier associatedwith an original destination device is an unallocated number.
 7. Thedevice of claim 1, where the one or more processors are further to:determine that a call from a calling party device to an originaldestination device is a local call; determine that a call from theoriginal destination device to the called party device is a longdistance call; and determine that a call from the calling party deviceto the called party device is a long distance call.
 8. A non-transitorycomputer-readable medium storing instructions, the instructionscomprising: one or more instructions that, when executed by one or moreprocessors, cause the one or more processors to: receive, from a networkdevice, call information associated with a call; determine, based on thecall information, that the call appears to have been forwarded to acalled party device; determine, based on the call information, aforwarding characteristic for the call; determine that the forwardingcharacteristic satisfies a criterion based on at least one of: aforwarding rate deviating from a baseline forwarding rate, theforwarding rate satisfying a first threshold, a forwarding scheduledeviating from a baseline forwarding schedule, or the forwardingschedule satisfying a second threshold; send an output message, based onthe forwarding characteristic satisfying the criterion, to supportresponding to call forwarding activity having the forwardingcharacteristic; and cause the network device to automatically takeaction based on the output message.
 9. The non-transitorycomputer-readable medium of claim 8, where the one or more instructionsthat, when executed by one or more processors, further cause the one ormore processors to: determine, based on the call information, aforwarding baseline, the forwarding baseline being associated with atleast one of: a calling party device, an original destination device,the called party device, a network an upstream network, or a downstreamnetwork, and the forwarding baseline including at least one of: thebaseline forwarding rate, a baseline of service types, or the baselineforwarding schedule; and where the one or more instructions, that causethe one or more processors to determine that the forward characteristicsatisfies the criterion, cause the one or more processors to: determinethat the forward characteristic satisfies the criterion based on theforwarding baseline.
 10. The non-transitory computer-readable medium ofclaim 9, where the forwarding baseline is based on historical callforwarding activity associated with at least one of: the calling partydevice, the original destination device, the called party device, thenetwork, the upstream network, or the downstream network.
 11. Thenon-transitory computer-readable medium of claim 9, where the forwardingbaseline is based on call forwarding activity that has been agreed uponby a user of at least one of: the calling party device, the originaldestination device, or the called party device.
 12. The non-transitorycomputer-readable medium of claim 9, where the forwarding baseline isbased on call forwarding activity that has been agreed upon by anoperator of at least one of: the network, the upstream network, or thedownstream network.
 13. The non-transitory computer-readable medium ofclaim 8, where the one or more instructions, that cause the one or moreprocessors to determine that the forwarding characteristic satisfies thecriterion, cause the one or more processors to: determine that theforwarding characteristic satisfies the criterion based on a deviationfrom a forwarding baseline.
 14. The non-transitory computer-readablemedium of claim 8, where the call information includes at least one of:call origination information; call destination information; deviceinformation; network information; billing information; call routinginformation; or a call detail record (CDR).
 15. A method, comprising:receiving, by a device and from a network device, call informationassociated with a call; determining, by the device and based on the callinformation, that the call appears to have been forwarded to a calledparty device; determining, by the device and based on the callinformation, a forwarding characteristic for the call; determining, bythe device, that the forwarding characteristic satisfies a criterionbased on at least one of: a forwarding rate deviating from a baselineforwarding rate, the forwarding rate satisfying a first threshold, aforwarding schedule deviating from a baseline forwarding schedule, orthe forwarding schedule satisfying a second threshold; sending, by thedevice and based on the forwarding characteristic satisfying thecriterion, an output message to support responding to call forwardingactivity having the forwarding characteristic; and causing, by thedevice, the network device to automatically take action based on theoutput message.
 16. The method of claim 15, further comprising:determining that a first call from a calling party device to adestination device is a local call; and determining that a second callfrom the destination device to the called party device is a longdistance call; and where determining that the forwarding characteristicsatisfies the criterion comprises: determining that the forwardingcharacteristic satisfies the criterion based on determining that thefirst call is a local call and the second call is a long distance call.17. The method of claim 15, further comprising: determining that a firstcall from a calling party device to a destination device is a localcall; and determining that a second call from the calling party deviceto the called party device is a long distance call; and wheredetermining that the forwarding characteristic satisfies the criterioncomprises: determining that the forwarding characteristic satisfies thecriterion based on determining that the first call is a local call andthe second call is a long distance call.
 18. The method of claim 15,where determining that the forwarding characteristic satisfies thecriterion comprises: determining that the forwarding characteristicsatisfies the criterion based on a device identifier associated with adestination device being an unallocated number.
 19. The method of claim15, where determining that the call appears to have been forwarded tothe called party device comprises: determining that the call appears tohave been forwarded to the called party device based on a messageincluded in the call information.
 20. The method of claim 19, where themessage comprises an original called number parameter.